The Model Context Protocol, or MCP, is an open standard introduced by Anthropic in late 2024 that lets artificial intelligence (AI) agents connect to business systems the way applications call application programming interfaces (APIs) using a common interface instead a custom-built connection for each tool, PYMNTS reported. Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required. By completing this form, you agree to receive marketing communications from PYMNTS and to the sharing of your information with our sponsor, if applicable, in accordance with our Privacy Policy and Terms and Conditions. Before MCP, integrating an AI model into a company’s internal software required bespoke engineering for every system. The protocol eliminated that friction, letting AI agents operate directly inside enterprise systems. The International Data Corporation projected that active AI agents in enterprises will grow from 28.6 million in 2025 to more than 2.2 billion by 2030. Each of those connections runs through a description the agent trusts. Microsoft Incident Response published a warning that attackers can hide malicious instructions inside the descriptions MCP tools use to explain themselves to AI agents. Each tool includes a short text description telling the agent what the tool does. An agent reads that description before acting. If an attacker modifies it to include hidden instructions, the agent follows them, believing the order came from a source it trusts. Microsoft illustrated the attack with a finance scenario: an agent connects to a vendor invoice tool whose description has been surreptitiously modified, collects invoice files using the analyst’s own permissions and routes them to an outside server, all while returning a normal-looking answer. The problem is structural. Tool descriptions and user instructions share the same space inside an agent’s working memory.

Changing a description steers the agent’s behavior as effectively as rewriting its underlying instructions. Microsoft called this a “trust boundary” problem: the agent cannot distinguish a legitimate instruction from its owner and one inserted by whoever controls a connected tool. The attack has a track record. Security researchers at Invariant Labs demonstrated it in 2025, hiding instructions in a tool’s description to trick an AI coding assistant into sending private credentials to an external address, The Hacker News reported. In September, a software package trusted for 15 clean releases was updated with a hidden instruction that copied every email an AI agent sent to an outside address, The Hacker News added. The Financial Stability Board also warned recently that AI agents can create risks that materialize faster than human oversight can catch, PYMNTS reported. Banks have moved faster on MCP than the security frameworks governing it. For example, Moody’s deployed MCP-based agents that reduced credit memo preparation from 40 hours to two minutes, PYMNTS reported. Dun & Bradstreet connected its commercial risk database to Claude via MCP to automate customer and business verification. MCP adoption across banking is accelerating just as quickly. Taktile CEO Maik Taro Wehmeyer told PYMNTS CEO Karen Webster that 2026 is “the year where AI will come to financial services,” with agents beginning to automate commercial lending, insurance claims and business underwriting, PYMNTS reported. Each deployment connects an AI agent to systems holding payment data, customer records or regulatory documentation and usually happens via MCP. The attack Microsoft documented does not require a breach. It requires access to a tool description. A poisoned description executes using the agent’s own credentials, through an approved channel, at a moment that looks like routine work. That is precisely how banks have been told to think about agent governance. Rob Rooney, CEO of Hyperlayer, told Webster that as AI agents begin acting on behalf of customers, banks need approvals, controls, audit trails and data lineage capable of operating at machine speed. Banks Are Racing Into AI Faster Than Security Can Follow BlackRock Says Hyperscalers Need Private Credit to Fund AI Boom The New Procurement Edge Isn’t Lower Cost. It’s Earlier Warning Open Banking Moves From Data Rights to Data Pricing